enable TPM HW PP(physical presence) in bootloader

[Shpinkso]

The bootloader does not enable or activate the tpm (which is fine for now) however it also doesn't enable the HW PP line either which may be confusing for a user trying to use it to set things up. Technically they could use the SW PP to do the same thing at the moment but this is a security risk and should be locked out.

Acceptance criteria:

• Once booted HW physical presence must be usable
• Once booted SW physical presence must be NOT usable
• The PP config should be locked so no one can change the status of the above unless they reset the tpm
• The global lock should be open

[Ham22]

• Once booted SW physical presence must be NOT usable

Can't keep to this because the old boards didn't have valid HW presence connections. If I was to lock out SW PP there would be no way to assert PP at all on old boards. This leaves the device vulnerable until locked by the user.

[Ham22]

Turns out that the HW PP is enabled by default, it was just hidden due to the previous HW bug. The SW PP can be enabled by a user because we don't currently lock it out so we already have all the bits we can feasibly do (due to the above comment). @Shpinkso you happy with closing this ticket as is?

[Shpinkso]

yerp